Identification & Authentication Failures

Formerly called Broken Authentication, this category covers every weakness in how the application proves who a user is and maintains that identity across requests. A successful attack lets an adversary impersonate another user — temporarily or permanently. It sits at #7 (2021).

Types of Authentication Failures

• Weak session tokens — tokens derived from predictable values (MD5(username), timestamp, user_id). An attacker who can guess or compute a token hijacks the session
• Username enumeration — different error messages for "user not found" vs "wrong password" allow attackers to validate email/username lists before targeted attacks
• No brute-force protection — unlimited login attempts; attackers can automate credential stuffing from data breach dumps (e.g. 8.4 billion credentials in RockYou2021)
• Credential stuffing — testing breached credentials (username:password pairs) from one site against another; works because users reuse passwords across sites
• Missing MFA — high-value accounts (admin, finance, DevOps) without multi-factor authentication are trivially taken over by phishing or credential stuffing
• Session fixation — session ID not rotated after login; attacker plants a known session ID before login and inherits the authenticated session
• Long-lived tokens — JWTs or API keys that never expire; a leaked token is valid indefinitely

Weak Session Token — Vulnerable Code

import hashlib

# VULNERABLE — session is MD5(username); attacker computes it trivially
def create_session(username: str) -> str:
    return hashlib.md5(username.encode()).hexdigest()   # deterministic, no randomness

# MD5("admin") = 21232f297a57a5a743894a0e4a801fc3
# MD5("alice")  = 6384e2b2184bcbf58eccf10ca7a6563c
# Any known username → instant token forgery

Username Enumeration — Vulnerable Code

# VULNERABLE — different messages reveal whether a user exists
@app.post("/login")
def login(username: str, password: str):
    user = db.get_user(username)
    if not user:
        return {"error": "User not found"}           # confirms username does NOT exist
    if not check_password(password, user.hash):
        return {"error": "Invalid password"}         # confirms username DOES exist
    return {"token": create_session(user)}

Fixed Code

import secrets
from datetime import datetime, timedelta

# FIXED — cryptographically random session token
def create_session(user_id: int) -> str:
    token = secrets.token_hex(32)   # 256 bits of randomness; unguessable
    sessions[token] = {"user_id": user_id, "expires": datetime.utcnow() + timedelta(hours=8)}
    return token

# FIXED — identical error message regardless of whether user exists
@app.post("/login")
def login(username: str, password: str):
    user = db.get_user(username)
    # Always run check_password even if user is None (prevents timing attacks)
    # Use bcrypt.checkpw with a dummy hash for non-existent users
    dummy_hash = "$2b$12$invalidhashfortimingprotection"
    valid_hash = user.password_hash if user else dummy_hash
    password_ok = bcrypt.checkpw(password.encode(), valid_hash.encode())
    if not user or not password_ok:
        return {"error": "Invalid username or password"}  # same message either way
    return {"token": create_session(user.id)}

Real-World Breaches

• Slack (2015) — Token theft via XSS; session tokens were long-lived and not rotated, allowing persistent account access
• Zoom (2020) — Credential stuffing attack used 500,000 stolen credentials; valid pairs were sold on dark web forums
• GitHub (2012) — Mass password reset after credential stuffing; GitHub accounts were protected only by password with no MFA requirement
• Colonial Pipeline (2021) — VPN account with no MFA was compromised via a leaked password from a breached database; led to the largest US fuel pipeline shutdown

How to Fix — Checklist

• Cryptographically random session tokens — secrets.token_hex(32); store all session data server-side
• Uniform error messages — always return the same message for invalid credentials regardless of which field was wrong
• Account lockout / rate limiting — lock after 5–10 failed attempts; exponential backoff; CAPTCHA
• Rotate session ID on login — create a new token immediately after successful authentication; invalidate the pre-login token
• Short session expiry — idle timeout (15–30 min for sensitive apps) + absolute timeout (8–24 hours)
• MFA for all privileged accounts — TOTP (Google Authenticator, Authy) or hardware keys (FIDO2/WebAuthn) for admin and service accounts
• Breach credential checks — on registration and password change, check against HaveIBeenPwned Passwords API